A simple and good way to detect file changes is to generate hashes (for files with specific file extensions), and compares them with the previous scans hashes stored in a database. It's a great way for site owners to be alerted to files that have been added, altered or deleted by a hacker.

PTSource WebSafe is a script that will report and notify you of any changes to files in an web account whether the file change is an addition, alteration or deletion. PTSource WebSafe was designed not to overwhelm the webmaster, it only provides a report of changes since the last scan. Because the scan of a 1500 file account takes 0.75 seconds, PTSource WebSafe can be run frequently without affecting server performance.

• Upload websafe.db, websafe.ini and websafe.php your website root.
• Open websafe.ini and configure with your notification details.
• Add websafe.php to CRON in CPanel to run as desired.

Minute	Hour	Day	Month	Weekday		Command
0	0	*	*	*		/usr/local/bin/php /home/account/websafe.php

• To add extra sucurity and disable access to the configuration file and the database you shoud add the following to your .htaccess file.

## WEBSAFE ##
<FilesMatch "\.(?:db|ini)$">
Order allow,deny
Deny from all
</FilesMatch>

Developed using php 7.4.5 with SQLite but it should work with any php version.